Back to blog
Why workspace isolation is the foundation of publishing
How membership, roles, and social-account assignments work together to protect team data.
Membership alone is not enough
Being signed in to a social media management product must not grant access to every piece of content or every account. PLANLISH verifies workspace membership, explicit role permission, and resource scope on the server for each product operation.
Social accounts can belong to the subscription holder, but a member can use an account only when it is explicitly assigned to their workspace. Two teams under the same subscription therefore cannot access each other's accounts.
Parts of the security boundary
- Requests operate with an explicit
workspaceId. - Resource identifiers are queried together with workspace scope.
- The Viewer role cannot mutate data.
- Publishing and approval permissions are evaluated separately.
- Plan limits are enforced centrally on the server.
This goes beyond hiding a button in the interface and makes tenant isolation the actual boundary for data access.